CVE-2024-5989

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke SQL injection into the program and cause a remote code execution condition on the Rockwell Automation ThinManager® ThinServer™.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Rockwell Automation	ThinManager® ThinServer™	11.0.0; 11.2.0; 12.0.0; 12.1.0; 13.0.0; 13.1.0; 13.2.0
rockwellautomation	thinmanager	>= 11.1.0, < 11.1.8; >= 11.2.0, < 11.2.9; >= 12.0.0, < 12.0.7; >= 12.1.0, < 12.1.8; >= 13.0.0, < 13.0.4; >= 13.1.0, < 13.1.2; >= 13.2.0, < 13.2.2
rockwellautomation	thinmanager	>= 11.1.0, < 11.1.8; >= 11.2.0, < 11.2.9; >= 12.0.0, < 12.0.7; >= 12.1.0, < 12.1.8; >= 13.0.0, < 13.0.4; >= 13.1.0, < 13.1.2; >= 13.2.0, < 13.2.2
rockwellautomation	thinmanager	>= 11.1.0, < 11.1.8; >= 11.2.0, < 11.2.9; >= 12.0.0, < 12.0.7; >= 12.1.0, < 12.1.8; >= 13.0.0, < 13.0.4; >= 13.1.0, < 13.1.2; >= 13.2.0, < 13.2.2
rockwellautomation	thinmanager	>= 11.1.0, < 11.1.8; >= 11.2.0, < 11.2.9; >= 12.0.0, < 12.0.7; >= 12.1.0, < 12.1.8; >= 13.0.0, < 13.0.4; >= 13.1.0, < 13.1.2; >= 13.2.0, < 13.2.2
rockwellautomation	thinmanager	>= 11.1.0, < 11.1.8; >= 11.2.0, < 11.2.9; >= 12.0.0, < 12.0.7; >= 12.1.0, < 12.1.8; >= 13.0.0, < 13.0.4; >= 13.1.0, < 13.1.2; >= 13.2.0, < 13.2.2
rockwellautomation	thinmanager	>= 11.1.0, < 11.1.8; >= 11.2.0, < 11.2.9; >= 12.0.0, < 12.0.7; >= 12.1.0, < 12.1.8; >= 13.0.0, < 13.0.4; >= 13.1.0, < 13.1.2; >= 13.2.0, < 13.2.2
rockwellautomation	thinmanager	>= 11.1.0, < 11.1.8; >= 11.2.0, < 11.2.9; >= 12.0.0, < 12.0.7; >= 12.1.0, < 12.1.8; >= 13.0.0, < 13.0.4; >= 13.1.0, < 13.1.2; >= 13.2.0, < 13.2.2

References

Timeline

Published: Jun 25, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-59907.5Due to an improper input validation, an unauthenticated threat actor can send a malicious message to a monitor thread within Rockwell Automa CVE-2024-59917.5In function MatchDomainName(), input param str is treated as a NULL terminated string despite being user provided and unchecked. Specificall CVE-2024-59926.5The Cliengo – Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'upda CVE-2024-59935.4The Cliengo – Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'upda CVE-2024-59945.4The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom JS option in versions CVE-2024-59958.8The notification emails sent by Soar Cloud HR Portal contain a link with a embedded session. The expiration of the session is not properly c CVE-2024-59974.3The Duplica – Duplicate Posts, Pages, Custom Posts or Users plugin for WordPress is vulnerable to unauthorized modification of data due to a CVE-2024-59987.8A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. CVE-2024-60007.1The FooEvents for WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an improper capability settin CVE-2024-60018.1An improper certificate validation vulnerability was reported in LADM that could allow a network attacker with the ability to redirect an up CVE-2024-60037.3A vulnerability was found in Guangdong Baolun Electronics IP Network Broadcasting Service Platform 2.0. It has been classified as critical. CVE-2024-60046.5A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to d